qemu/hw/virtio
Carlos López bbc1c327d7 virtio: fix reachable assertion due to stale value of cached region size
In virtqueue_{split,packed}_get_avail_bytes() descriptors are read
in a loop via MemoryRegionCache regions and calls to
vring_{split,packed}_desc_read() - these take a region cache and the
index of the descriptor to be read.

For direct descriptors we use a cache provided by the caller, whose
size matches that of the virtqueue vring. We limit the number of
descriptors we can read by the size of that vring:

    max = vq->vring.num;
    ...
    MemoryRegionCache *desc_cache = &caches->desc;

For indirect descriptors, we initialize a new cache and limit the
number of descriptors by the size of the intermediate descriptor:

    len = address_space_cache_init(&indirect_desc_cache,
                                   vdev->dma_as,
                                   desc.addr, desc.len, false);
    desc_cache = &indirect_desc_cache;
    ...
    max = desc.len / sizeof(VRingDesc);

However, the first initialization of `max` is done outside the loop
where we process guest descriptors, while the second one is done
inside. This means that a sequence of an indirect descriptor followed
by a direct one will leave a stale value in `max`. If the second
descriptor's `next` field is smaller than the stale value, but
greater than the size of the virtqueue ring (and thus the cached
region), a failed assertion will be triggered in
address_space_read_cached() down the call chain.

Fix this by initializing `max` inside the loop in both functions.

Fixes: 9796d0ac8f ("virtio: use address_space_map/unmap to access descriptors")
Signed-off-by: Carlos López <clopez@suse.de>
Message-Id: <20230302100358.3613-1-clopez@suse.de>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-03-07 19:51:07 -05:00
..
Kconfig vdpa: add vdpa-dev support 2022-12-21 06:35:28 -05:00
meson.build virtio: Move HMP commands from monitor/ to hw/virtio/ 2023-02-04 07:56:54 +01:00
trace-events vdpa: add vhost_vdpa_suspend 2023-03-07 12:38:59 -05:00
trace.h trace: switch position of headers to what Meson requires 2020-08-21 06:18:24 -04:00
vdpa-dev-pci.c vdpa: add vdpa-dev-pci support 2022-12-21 06:35:28 -05:00
vdpa-dev.c vdpa-dev: get iova range explicitly 2023-01-08 01:54:22 -05:00
vhost-backend.c vhost: add method vhost_set_vring_err 2022-06-27 18:53:18 -04:00
vhost-iova-tree.c util: accept iova_tree_remove_parameter by value 2022-09-02 10:22:39 +08:00
vhost-iova-tree.h util: accept iova_tree_remove_parameter by value 2022-09-02 10:22:39 +08:00
vhost-scsi-pci.c hw/virtio: move virtio-pci.h into shared include space 2022-05-16 04:38:40 -04:00
vhost-shadow-virtqueue.c vdpa: rewind at get_base, not set_base 2023-03-07 12:38:59 -05:00
vhost-shadow-virtqueue.h vhost: move iova_tree set to vhost_svq_start 2022-12-21 06:35:28 -05:00
vhost-stub.c vhost-user: simplify vhost_user_init/vhost_user_cleanup 2019-03-12 21:22:31 -04:00
vhost-user-blk-pci.c hw/virtio: move virtio-pci.h into shared include space 2022-05-16 04:38:40 -04:00
vhost-user-fs-pci.c hw/virtio: move virtio-pci.h into shared include space 2022-05-16 04:38:40 -04:00
vhost-user-fs.c vhost-user-fs: Back up vqs before cleaning up vhost_dev 2023-02-09 10:21:11 -05:00
vhost-user-gpio-pci.c hw/virtio: add vhost-user-gpio-pci boilerplate 2022-10-07 09:41:51 -04:00
vhost-user-gpio.c vhost-user-gpio: Configure vhost_dev when connecting 2023-03-02 03:10:47 -05:00
vhost-user-i2c-pci.c hw/virtio: move virtio-pci.h into shared include space 2022-05-16 04:38:40 -04:00
vhost-user-i2c.c vhost-user-i2c: Back up vqs before cleaning up vhost_dev 2023-03-02 03:10:47 -05:00
vhost-user-input-pci.c hw/virtio: move virtio-pci.h into shared include space 2022-05-16 04:38:40 -04:00
vhost-user-rng-pci.c hw/virtio: move virtio-pci.h into shared include space 2022-05-16 04:38:40 -04:00
vhost-user-rng.c vhost-user-rng: Back up vqs before cleaning up vhost_dev 2023-03-02 03:10:47 -05:00
vhost-user-scsi-pci.c hw/virtio: move virtio-pci.h into shared include space 2022-05-16 04:38:40 -04:00
vhost-user-vsock-pci.c hw/virtio: move virtio-pci.h into shared include space 2022-05-16 04:38:40 -04:00
vhost-user-vsock.c hw/virtio: introduce virtio_device_should_start 2022-11-07 14:08:18 -05:00
vhost-user.c hw/virtio/vhost-user: avoid using unitialized errp 2023-03-07 19:51:07 -05:00
vhost-vdpa.c vdpa: return VHOST_F_LOG_ALL in vhost-vdpa devices 2023-03-07 12:38:59 -05:00
vhost-vsock-common.c virtio: introduce macro VIRTIO_CONFIG_IRQ_IDX 2023-01-08 01:54:22 -05:00
vhost-vsock-pci.c hw/virtio: move virtio-pci.h into shared include space 2022-05-16 04:38:40 -04:00
vhost-vsock.c hw/virtio: introduce virtio_device_should_start 2022-11-07 14:08:18 -05:00
vhost.c vdpa: move vhost reset after get vring base 2023-03-07 12:38:59 -05:00
virtio-9p-pci.c hw/virtio: move virtio-pci.h into shared include space 2022-05-16 04:38:40 -04:00
virtio-balloon-pci.c hw/virtio: move virtio-pci.h into shared include space 2022-05-16 04:38:40 -04:00
virtio-balloon.c qapi: Use returned bool to check for failure (again) 2022-12-14 16:19:35 +01:00
virtio-blk-pci.c hw/virtio: move virtio-pci.h into shared include space 2022-05-16 04:38:40 -04:00
virtio-bus.c virtio: stop ioeventfd on reset 2022-06-14 16:50:30 +02:00
virtio-config-io.c hw/virtio: Extract config read/write accessors to virtio-config-io.c 2022-12-21 07:32:24 -05:00
virtio-crypto-pci.c Use DECLARE_*CHECKER* macros 2020-09-09 09:27:09 -04:00
virtio-crypto.c cryptodev: Use CryptoDevBackendOpInfo for operation 2023-03-07 12:38:59 -05:00
virtio-hmp-cmds.c virtio: Move HMP commands from monitor/ to hw/virtio/ 2023-02-04 07:56:54 +01:00
virtio-input-host-pci.c hw/virtio: move virtio-pci.h into shared include space 2022-05-16 04:38:40 -04:00
virtio-input-pci.c hw/virtio: move virtio-pci.h into shared include space 2022-05-16 04:38:40 -04:00
virtio-iommu-pci.c hw/virtio/virtio-iommu-pci: Enforce the device is plugged on the root bus 2022-11-07 13:12:19 -05:00
virtio-iommu.c hw: Use TYPE_PCI_BUS definition where appropriate 2023-01-28 06:21:30 -05:00
virtio-mem-pci.c qapi machine: Elide redundant has_FOO in generated C 2022-12-14 20:04:47 +01:00
virtio-mem-pci.h Use DECLARE_*CHECKER* macros 2020-09-09 09:27:09 -04:00
virtio-mem.c virtio-mem: Proper support for preallocation with migration 2023-02-06 19:22:56 +01:00
virtio-mmio.c bulk: Rename TARGET_FMT_plx -> HWADDR_FMT_plx 2023-01-18 11:14:34 +01:00
virtio-net-pci.c hw/virtio: move virtio-pci.h into shared include space 2022-05-16 04:38:40 -04:00
virtio-pci.c virtio-pci: fix proxy->vector_irqfd leak in virtio_pci_set_guest_notifiers 2023-01-08 01:54:23 -05:00
virtio-pmem-pci.c qapi machine: Elide redundant has_FOO in generated C 2022-12-14 20:04:47 +01:00
virtio-pmem-pci.h Use DECLARE_*CHECKER* macros 2020-09-09 09:27:09 -04:00
virtio-pmem.c include/block: Untangle inclusion loops 2023-01-20 07:24:28 +01:00
virtio-qmp.c vhost-user: Adopt new backend naming 2023-03-02 03:10:48 -05:00
virtio-qmp.h include/hw/virtio: Break inclusion loop 2023-01-08 01:54:22 -05:00
virtio-rng-pci.c virtio-rng-pci: Allow setting nvectors, so we can use MSI-X 2022-11-07 13:12:20 -05:00
virtio-rng.c virtio: drop name parameter for virtio_init() 2022-05-16 04:38:40 -04:00
virtio-scsi-pci.c hw/virtio: move virtio-pci.h into shared include space 2022-05-16 04:38:40 -04:00
virtio-serial-pci.c hw/virtio: move virtio-pci.h into shared include space 2022-05-16 04:38:40 -04:00
virtio-stub.c qmp: add QMP command x-query-virtio-queue-element 2022-10-09 16:38:45 -04:00
virtio.c virtio: fix reachable assertion due to stale value of cached region size 2023-03-07 19:51:07 -05:00